Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

보통레벨 1자동openshift-virt

설명

Setting the kubevirt Secure Computing Mode (seccomp) file permissions to 700 or more restrictive limits access to security related administrative functionality to approved administrators. Audit: Passes when the seccomp profile file of every virt-handler pod is mode 700 or more restrictive; a pod where the file does not exist (Secure Computing Mode feature gate not enabled) is not applicable. Requires oc logged in to the cluster with read access.

점검 방법

감사 방식: 셸 명령

shell

command -v oc >/dev/null 2>&1 || exit 1; bad=0; n=0; for pod in $(oc get pod -n openshift-cnv -l kubevirt.io=virt-handler --no-headers -o custom-columns=":metadata.name" 2>/dev/null); do n=$((n+1)); m=$(oc exec -n openshift-cnv "$pod" -c virt-handler -- sh -c 'f=/proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json; [ -e "$f" ] && stat -c %a "$f" || echo absent' 2>/dev/null); case "$m" in absent) ;; [0-7][0-7][0-7]|[0-7][0-7][0-7][0-7]) [ $((8#$m & 8#077)) -eq 0 ] || bad=1;; *) bad=1;; esac; done; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Update the permissions on each node using chmod : $ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 700 /proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json

속성

운영 체제: 모두
태그: openshift-virtseccompfile-permissions
참고 자료: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.8 Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target openshift-virt